Dashboards & Visualizations

Create a token from every field in a search

mew1033
Explorer

I have a search that I'm using to generate tokens on a dashboard. It only has 1 row, so I'm using `$result.<field>$`. There are a large number of fields, and I want all of them to be tokens. Is there a way I can do that? Maybe with the dashboard eval thing? Using foreach perhaps?

 

Thanks

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Technically speaking, you already have a token for every field - $result.<field>$.

What problem are you trying to solve with so many tokens?

---
If this reply helps you, Karma would be appreciated.
0 Karma

mew1033
Explorer

But wouldn't I have to enclose panels and such that need to use the $result.<field>$ syntax inside of the <search> tags? Can you do that?

 

I'm basically making a dashboard with a whole bunch of these:

mew1033_0-1638306489815.png

I'm injecting the numbers below the percentage via the tokens.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

In that case, you will have to assign each $result.<field>$ you wish to use later to a different token.  There's no shortcut for that, AFAIK.

---
If this reply helps you, Karma would be appreciated.
0 Karma

mew1033
Explorer

Ah, I was afraid of that. Oh well, thought I'd ask.

Thanks for the quick answers!

0 Karma
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...